# 单机版 Vault 配置（MySQL 存储）

# 基础配置
disable_mlock = true  # 开发环境可以禁用，生产环境应为 false
ui = true             # 启用网页界面
cluster_name = "vault_single_node"

# MySQL 存储配置
storage "mysql" {
  username = "root"          # MySQL 用户名
  password = "123456" # MySQL 密码
  database = "vault"           # 数据库名称
  address = "127.0.0.1:3306"      # MySQL 地址（本地）
  table = "vault_data"            # 存储表名
  max_parallel = 4                # 最大并行连接数

  # 连接池配置
  max_idle_connections = 5
  max_connection_lifetime = 300

  # 开发环境可禁用 TLS，生产环境必须启用
  # tls_ca_file = "/path/to/ca.pem"
}


# 采用默认解封方式，手动解封

# 文件自动解封
#seal "file" {
#  path = "/etc/vault/seal-key.txt"
#}

#seal "transit" {
#  address         = "http://127.0.0.1:8200"
#  token          = "hvs.CAESIBIe8qs5bpx4wi2k2XWa10gv_09tBqoYP9vfyEyvNMU7Gh4KHGh2cy5FQXdwenRpZ3c1bUNhMTBDWWhmTEtkVFk"  # 替换为有效 Token
#  key_name       = "auto-unseal-key"
#  mount_path     = "transit/"          # 必须指定
#  disable_renewal = "true"             # 可选（开发环境用）
# }

# 监听器配置（开发环境使用 HTTP）
listener "tcp" {
  address     = "0.0.0.0:8200"    # 监听地址
  tls_disable = 1                 # 生产环境必须设为 0 并配置 TLS

  # 生产环境 TLS 配置示例：
  # tls_cert_file = "/etc/vault/tls/cert.pem"
  # tls_key_file  = "/etc/vault/tls/key.pem"
  # tls_min_version = "tls12"
}

# API 地址配置
api_addr = "http://127.0.0.1:8200"

# 租约配置
default_lease_ttl = "24h"
max_lease_ttl = "72h"
